Features PEPPOL Pricing Contact Start Free Trial

Legal

Privacy policy

Last updated: 10 October 2026

1. Controller

InvoSys is a service of NETUX SRL. For www.invosys.io, the signup form, the newsletter, and the contact form, the controller is:

NETUX SRL
Rue de Thys 1 boîte A
4360 Oreye
Belgium
Enterprise number: 0881.501.752 (VAT BE 0881.501.752)
Email: support@invosys.io

NETUX SRL has not appointed a data protection officer. For any question about your data, write to support@invosys.io.

2. Controller or processor

NETUX SRL is the controller for marketing-site and signup data: the account holder’s name, company name, email, VAT number, workspace address, newsletter, contact-form messages, site logs, and audience measurement on this site.

NETUX SRL is the processor for data the customer enters in their workspace (name.apps.invosys.io). The customer decides why that data is processed. InvoSys processes it only to provide the service.

That workspace data includes the customer’s own customers and suppliers (names, addresses, VAT and enterprise numbers, contact details), invoices, quotes, credit notes and expenses with their lines and amounts, bank details such as IBAN and BIC, and Peppol identifiers.

3. Data, purposes, and legal bases

Account and trial

The signup form asks for a name, a company name, a workspace address, a VAT number, and an email address. All five are required. The workspace address is the subdomain of your workspace, shown as address.apps.invosys.io. The VAT number is needed for Belgian Peppol e-invoicing.

We also store a phone or mobile number if you give us one, a unique id, the time your email was verified, the time you accepted the terms, the creation date, and the end date of the 7-day trial.

Purpose: create the workspace, send the verification link, and provide the 7-day trial and the service. Legal basis: contract, or steps taken at your request before a contract (GDPR article 6(1)(b)). For the VAT number, also a legal obligation (article 6(1)(c)) where Belgian invoicing rules require it.

Once your email is verified, your name, workspace address, email, VAT number, phone numbers, and language are sent to the InvoSys application (apps.invosys.io) to create your workspace.

Newsletter

The newsletter field collects an email address only. We send a confirmation email, and the address is only used once you open the confirmation link. Legal basis: consent (article 6(1)(a)). Every newsletter email contains an unsubscribe link, and mail apps that support it show a one-click unsubscribe button. You can also write to support@invosys.io.

Contact form

Name, email, subject, and message. Nothing is sent to the NETUX SRL team when you submit the form. We store the submission for up to 24 hours and email you a confirmation link in the language of the page. That email does not include your message. We email the message to the NETUX SRL team, with a copy to you, only after you open the link and press Confirm. Opening the link does not send the message. The button works once. If you do not confirm, we delete the submission after 24 hours. After you confirm, we delete the stored message as well, and keep only a technical marker (without the message text) until the link expires, so pressing the button again does not send it again. The email received by our team is kept as long as needed to handle your request and any follow-up.

To limit abuse, we keep a short rate-limit counter for your IP address and for the email address you entered. Those counters expire within one hour and are not used for anything else.

Legal basis: our legitimate interest in answering your request and in protecting the form from abuse (article 6(1)(f)), and pre-contractual steps when the request is about a trial or subscription (article 6(1)(b)).

Logs

The server keeps technical logs. Workspace creation logs include the customer id and email address, and on failure the response from the application. Legal basis: legitimate interest in security and troubleshooting (article 6(1)(f)).

Audience measurement

With your consent, the site loads Google Analytics (ID G-XSMH366TMD) and the Meta pixel (ID 1668431453395928) to measure visits and the performance of our ads. The cookie banner has two separate categories: “Audience measurement” (Google Analytics) and “Marketing” (Meta pixel). Nothing is loaded until you accept the matching category. Legal basis: consent (article 6(1)(a) GDPR and the Belgian rules on cookies). You can change your choice at any time with the “Manage cookies” link at the bottom of every page.

4. Recipients

  • The InvoSys application (apps.invosys.io), operated by NETUX SRL, to create and run your workspace.
  • OVH SAS, which hosts the sites and databases on servers in France.
  • Amazon Web Services EMEA SARL (Amazon SES), which sends our emails (account verification, newsletter, contact form) from the EU (Ireland) region.
  • Digiteal SA, the Peppol access point. The application sends invoices to Digiteal and receives invoices from it to exchange them on the Peppol network. Digiteal acts as a processor for that purpose.
  • Google Ireland Limited (Google Analytics) and Meta Platforms Ireland Limited (Meta pixel), only if you accept the matching cookie category.
  • bunny.net (BunnyWay d.o.o., Slovenia), which serves the site’s typeface.

We do not sell your data.

5. Transfers outside the European Economic Area

Hosting (France), email (Ireland), and the typeface service (Slovenia) are in the EEA.

If you accept optional cookies, Google and Meta may transfer data to the United States. Both companies are certified under the EU–US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection, and also rely on the European Commission’s standard contractual clauses.

6. Retention

  • Account data: as long as your account exists. Billing and accounting data is then kept for 10 years, as Belgian accounting and VAT law requires.
  • Workspace data: invoices and related documents are kept by NETUX SRL for the customer for the 10-year legal retention period for invoices.
  • Newsletter: until you unsubscribe. After that, we keep only your address and the date you unsubscribed, so we respect your choice.
  • Contact messages: stored for at most 24 hours so you can confirm the message. Unconfirmed messages are then deleted. After confirmation, the stored copy is deleted and the email sent to our team is kept as long as needed to handle your request and any follow-up. Rate-limit counters (IP address and email address) expire within one hour.
  • Technical logs: as long as needed for security and troubleshooting.
  • The session cookie expires after 120 minutes of inactivity.

7. Your rights

You can ask for access, rectification, erasure, restriction, and portability, and you can object to processing based on legitimate interest. You can withdraw your consent (newsletter, optional cookies) at any time. Withdrawal does not affect processing that already took place.

Write to support@invosys.io. We do not make decisions based solely on automated processing that produce legal effects for you.

You can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit): https://www.dataprotectionauthority.be/.

8. Cookies and local storage

Strictly necessary, always set:

  • The session cookie (name ending in _session), which keeps the site working while you browse. It expires after 120 minutes of inactivity.
  • The XSRF-TOKEN cookie, which protects forms against forged submissions. Same lifetime as the session.
  • invosys_consent, which stores your cookie choice for 6 months.
  • Your light or dark theme, stored in your browser’s local storage under the key theme. That is not a cookie.

Optional cookies, only with your consent:

  • Audience measurement (Google Analytics): _ga and _ga_XSMH366TMD (2 years), _gid (24 hours), _gat (1 minute).
  • Marketing (Meta pixel): _fbp (90 days), and _fbc (90 days) when you arrive from a Meta ad.

If you withdraw your consent, the site deletes these cookies and stops loading Google Analytics and the Meta pixel.

9. Whether data is required

Without a name, company name, workspace address, VAT number, and email, we cannot create your account. The newsletter and the contact form are optional. Refusing optional cookies has no effect on how the site works.

10. Updates

We may update this policy. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell account holders by email.